{"record":{"id":"9250999c6ad6dd42","repo":"apache/pulsar","slug":"invalid-package-url-s","errorCode":null,"errorMessage":"Invalid package url: %s","messagePattern":"Invalid package url: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/ComponentImpl.java","lineNumber":1458,"sourceCode":"                ? functionMetaData.getTransformFunctionPackageLocation().getPackagePath()\n                : functionMetaData.getPackageLocation().getPackagePath();\n\n        FunctionDetails.ComponentType componentType = transformFunction\n                ? FunctionDetails.ComponentType.FUNCTION\n                : InstanceUtils.calculateSubjectType(functionMetaData.getFunctionDetails());\n\n        return getStreamingOutput(pkgPath, componentType);\n    }\n\n    private StreamingOutput getStreamingOutput(String pkgPath) {\n        return getStreamingOutput(pkgPath, null);\n    }\n\n    private StreamingOutput getStreamingOutput(String pkgPath, FunctionDetails.ComponentType componentType) {\n        return output -> {\n            if (pkgPath.startsWith(Utils.HTTP)) {\n                if (!worker().getPackageUrlValidator().isValidPackageUrl(componentType, pkgPath)) {\n                    throw new IllegalArgumentException(\"Invalid package url: \" + pkgPath);\n                }\n                URL url = URI.create(pkgPath).toURL();\n                try (InputStream inputStream = url.openStream()) {\n                    IOUtils.copy(inputStream, output);\n                }\n            } else if (pkgPath.startsWith(Utils.FILE)) {\n                if (!worker().getPackageUrlValidator().isValidPackageUrl(componentType, pkgPath)) {\n                    throw new IllegalArgumentException(\"Invalid package url: \" + pkgPath);\n                }\n                URI url = URI.create(pkgPath);\n                File file = new File(url.getPath());\n                Files.copy(file.toPath(), output);\n            } else if (pkgPath.startsWith(Utils.BUILTIN)\n                    && !worker().getWorkerConfig().getUploadBuiltinSinksSources()) {\n                Path narPath = getBuiltinArchivePath(pkgPath, componentType);\n                log.info().attr(\"pkgPath\", pkgPath).attr(\"narPath\", narPath).log(\"Loading from\");\n                try (InputStream in = new FileInputStream(narPath.toString())) {\n                    IOUtils.copy(in, output, 1024);","sourceCodeStart":1440,"sourceCodeEnd":1476,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/worker/src/main/java/org/apache/pulsar/functions/worker/rest/api/ComponentImpl.java#L1440-L1476","documentation":"When the function package path is an HTTP URL, the worker validates it with getPackageUrlValidator() before streaming. If the URL is not acceptable (wrong host scheme/extension/policy), an IllegalArgumentException('Invalid package url: ...') is thrown while writing the streaming response.","triggerScenarios":"Downloading a function whose package URL starts with http(s) and fails PackageUrlValidator.isValidPackageUrl; also URI.create(pkgPath).toURL() may throw for malformed URLs.","commonSituations":"Function submitted with an http package URL the worker policy disallows; unvalidated/malicious URL blocked by the validator; URL with characters that break URI parsing.","solutions":["Use a package URL permitted by the worker's package URL validator (check its configuration)","Prefer file:// (dlog) package URLs uploaded via BookKeeper","Validate the URL format client-side before submitting the function","Check worker logs for the validator's rejection reason"],"exampleFix":"// before\nString pkg = \"http://evil.example.com/x.jar\";\n// after\nString pkg = \"file:///pulsar/functions/myfunc.jar\"; // or an allow-listed http URL","handlingStrategy":"validation","validationCode":"boolean ok = pkgPath.startsWith(\"http\") && pkgPath.matches(\"^https?://[a-zA-Z0-9.-]+/[-a-zA-Z0-9@:%._+~#=/]*\\\\.(jar|nar)$\");\nif (!ok) throw new IllegalArgumentException(\"URL not allowed by worker policy: \" + pkgPath);","typeGuard":null,"tryCatchPattern":"try { download(); } catch (IllegalArgumentException e) { log.error(\"package URL rejected: {}\", e.getMessage()); }","preventionTips":["Use dlog/file package URLs uploaded through BookKeeper","Keep package URLs on the worker's allow-list (host/extension)","Percent-encode URLs properly","Validate URLs at function-submission time, not download time"],"tags":["validation","url","download","security"],"backgroundTag":"invalid-package-url","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}